############################################################################
##
## Copyright (c) 2000 BalaBit IT Ltd, Budapest, Hungary
##
## This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation; either version 2 of the License, or
## (at your option) any later version.
##
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
## GNU General Public License for more details.
##
## You should have received a copy of the GNU General Public License
## along with this program; if not, write to the Free Software
## Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
##
## $Id: policy.py,v 1.49.2.2.2.2 2001/09/04 09:42:56 bazsi Exp $
##
############################################################################

from Zorp.Core import *
#from Zorp.Http import *
#from Zorp.Plug import *
#from Zorp import Auth
#from Zorp.Ftp import *
#from Zorp.Telnet import *
from Zorp.Http import *
#from Zorp.Pssl import *
#from Zorp.Lp import *
#from Zorp.Nntp import *
#from Zorp.Imap import *

import re, string

Zorp.firewall_name = 'bzorp@balabit'

###################
# Zone declaration 
#
InetZone('balabit', '192.168.131.0/24', 
	 outbound_services=["*"], 
	 inbound_services=["*"])

InetZone('local', '127.0.0.1/8', 
	 outbound_services=["*"], 
	 inbound_services=["*"])

InetZone('balabit-intra', '10.0.0.0/24',
	 outbound_services=["*"], 
	 inbound_services=["*"])

InetZone('internet', '0.0.0.0/0', 
	 inbound_services=["*"])

InetZone('balabit.balabit', ['192.168.131.37', '127.0.0.5'], 
	 outbound_services=["finger"], 
	 admin_parent='balabit')

#class MyPlug(PlugProxy):
#	def config(self):
#		pass #raise NotImplementedError
#		

class MyHttp(HttpProxy):
	#matcher = RegexpFileMatcher('/etc/zorp/http.match', '/etc/zorp/http.match.ignore')

	def config(self):
                HttpProxy.config(self)
                self.transparent_mode = TRUE
                self.timeout = -1
		self.request["GET"] = (HTTP_REQ_POLICY, self.redirect)
		self.request["PUT"] = (HTTP_REQ_REJECT, "valami")
                self.request_header["User-Agent"] = \
                        [HTTP_CHANGE_VALUE, "Lynx/2.8.3rel.1 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/69.69.4"]

	def redirect(self, method, url, version):
		#self.request_url = 'http://index.hu/index.html'
		return HTTP_REQ_ACCEPT

#
#class MyHttpsProxy(PsslProxy):
#
#	class EmbeddedHTTP(HttpProxy):
#		def config(self):
#			HttpProxy.config(self)
#			self.transparent_proxy = TRUE
#			self.request_headers["Host"] = (HTTP_CHANGE_VALUE, "szerk.tv2.hu")
#
#	def config(self):
#		self.server_need_ssl = TRUE
#		#self.server_verify_type = SSL_VERIFY_REQUIRED_TRUSTED
#		#self.server_ca_directory = '/etc/zorp/tv2.ssl/ca.crt'
#		#self.server_cert = '/etc/zorp/tv2.ssl/balabit.crt'
#		#self.server_key = '/etc/zorp/tv2.ssl/balabit.key'
#
#		self.client_need_ssl = TRUE
#		self.client_verify_type = SSL_VERIFY_NONE
#		self.client_cert = '/home/bazsi/src/zorp-nonfree/ca/server.crt'
#		self.client_key = '/home/bazsi/src/zorp-nonfree/ca/server.key'
#		self.stack_proxy = self.EmbeddedHTTP
#

#class DummyAuthorization(Authorization):
#        def getMethods(self, session_id, entity):
#                return ('PASS',)
#
#        def getChallenge(self, session_id, entity, method):
#                return None
#        
#        def checkCredentials(self, session_id, entity, method, challenge, credentials):
#                if method == 'PASS' and challenge == '' and entity == 'bazsi' and credentials == 'titkos':
#                        return TRUE
#                return FALSE
#

#class MyFtp(FtpProxyRW):
#	def config(self):
#		FtpProxyRW.config(self)
#		#self.transparent_mode = FALSE

def zorp():

	#print Service
	r = ZASAuthorization('authdb', SockAddrInet('127.0.0.1', 7777))
	#r = TISAuthorization(SockAddrUnix('/tmp/authsock'), 1)
	#r = DummyAuthorization(('PASS'))
 	#Service("finger", DirectedChainer(SockAddrInet('127.0.01', 79)), MyFinger)
 	
 	#Service("lp", LpProxy,
 	#	router=DirectedRouter(SockAddrInet('127.0.0.1', 515)))
	#
 	#Service("imap", ImapProxy,
 	#	router=DirectedRouter(SockAddrInet('127.0.0.1', 143)))
 	#	
 	#Service("nntp", NntpProxy,
 	#	router=DirectedRouter(SockAddrInet('212.108.197.74', 119)))
 	#Service("ftp", MyFtp, DirectedRouter(SockAddrInet('192.168.131.1', 21)))
 	Service("http", MyHttp,
 		router=DirectedRouter(SockAddrInet('192.168.131.1', 80)),
 		auth=SatyrAuthentication('authdb'))

 	#Service("http", MyHttp,
 	#	router=DirectedRouter(SockAddrInet('192.168.131.1', 80)),
 	#	auth=InbandAuthentication(r))
 	#Service("https", MyHttpsProxy,
 	#	router=DirectedRouter(SockAddrInet('192.168.131.1', 443)))
	#Service("telnet", TelnetProxy, router=DirectedRouter(SockAddrInet('192.168.131.37', 23)))
 	#Listener(SockAddrInet("192.168.131.37", 1515), "lp")
 	#Listener(SockAddrInet("127.0.0.1", 1143), "imap")
 	#Listener(SockAddrInet("0.0.0.0", 1119), "nntp")
	#Listener(SockAddrInet('0.0.0.0', 1998), "finger")
	#Listener(SockAddrInet('0.0.0.0', 1443), "https")
	Listener(SockAddrInet('0.0.0.0', 8080), "http")
	#Listener(SockAddrInet('0.0.0.0', 2323), "telnet")
	#Listener(SockAddrInet('0.0.0.0', 7777), "plug")
	#Listener(SockAddrInet('0.0.0.0', 2121), "ftp")
